How to add roles, permissions to a user during signup?

[ilyas-shah]

I have an application whose end users I like to store in Auth0 “Database” connection.
I want to have end users credentials (username + password) to authenticate them with Auth0. On Successful login, I want Auth0 to return an id_token which has a user role, permissions. Also, I want to know how I can I set these roles and permissions when a user signsup?

[dan.woda]

Hi @ilyas-shah,

Thanks for joining us in the Auth0 Community!

You can setup RBAC so your roles are automatically associated with permissions.

Role-Based Access Control

This FAQ shows how to add a role upon signup:

How do I add a default role to a new user on first login?

Question: How do I assign a default role to a new user on first login? Answer: If you are using the Authorization Core, you can leverage the Management API in a rule to assign a role based on login count. Example Rule: function (user, context, callback) { const count = context.stats && context.stats.loginsCount ? context.stats.loginsCount : 0; if (count > 1) { return callback(null, user, context); } const ManagementClient = require('auth0@2.27.0').ManagementClient; …

You could customize the rule to automatically set roles based on different factors like IP, email domain, etc.

You could add that role to the token as a custom claim like this:

OpenID Connect Scopes

Let me know if that helps! Also let me know if you need some more insight on this.

Thanks,
Dan

[ilyas-shah]

thanks @dan.woda for your quick response. I will go through these topics and get back to you in case I have a question.

[andy_hutch]

Hi @dan.woda,
I have followed the above and I can add the current user to a role.

Unfortunately the roles/permissions do not make it into the access token until they re-authenticate.

Is there anyway to refresh the token from within the rule in order to add/refresh the claims with the Issuer of “https://xxxx.eu.auth0.com/”?

This article also describes the same situation here:

After applying a Role to a User using a Rule at signup (first login), the permissions are not in the user's access token

I followed the instructions in How do I add a default role to a new user on first login? to add a Role upon signup/initial login. The Role gets applied correctly. However, the problem is that the initial access token the user is given doesn’t have the permissions for that role in it. If the subsequently login again, the permissions are there. I suppose that this is because either the access token has already been generated by the time the rule is executed or because there’s a slight delay bet…

[andy_hutch]

I got this working as detailed here:

After applying a Role to a User using a Rule at signup (first login), the permissions are not in the user's access token

Many thanks @pvarner. This worked for me. For anyone’s reference I used this code to refresh the token, which included the updated roles/permissions: renewToken() { this.auth0Client$.subscribe((client: Auth0Client) => { client.getTokenSilently({ audience: config.audience, scope: config.domain, ignoreCache: true }); }); }